@wlv-zedd/dsh-chatgpt-web 1.0.0

package/src/lib/errors.ts

@@ -0,0 +1,281 @@
+export interface CodexErrorPayload {
+  message: string;
+  type: string;
+  code: string | null;
+}
+
+function isSubscriptionGateMessage(text: string): boolean {
+  return (
+    text.includes("requires a subscription") ||
+    text.includes("requires subscription") ||
+    text.includes("subscription required") ||
+    text.includes("upgrade for access") ||
+    text.includes("upgrade to pro") ||
+    text.includes("pro subscription") ||
+    (text.includes("upgrade") && text.includes("subscription"))
+  );
+}
+
+function isAuthenticationMessage(text: string): boolean {
+  const accessDeniedWithCredentialCue = (
+    text.includes("access denied") ||
+    text.includes("accessdeniedexception")
+  ) && (
+    text.includes("authentication") ||
+    text.includes("credential") ||
+    text.includes("api key") ||
+    text.includes("token") ||
+    text.includes("signature")
+  );
+  return (
+    text.includes("authentication failed") ||
+    text.includes("authentication") ||
+    text.includes("invalid_api_key") ||
+    text.includes("invalid api key") ||
+    text.includes("invalid token") ||
+    text.includes("unauthorizedexception") ||
+    text.includes("unrecognizedclientexception") ||
+    text.includes("unrecognizedclient") ||
+    text.includes("expired token") ||
+    text.includes("expiredtoken") ||
+    text.includes("unauthenticated") ||
+    text.includes("unauthorized") ||
+    accessDeniedWithCredentialCue
+  );
+}
+
+function isPermissionMessage(text: string): boolean {
+  return (
+    text.includes("permission_denied") ||
+    text.includes("permission denied") ||
+    text.includes("forbidden") ||
+    text.includes("access denied") ||
+    text.includes("accessdeniedexception") ||
+    text.includes("not allowed to use") ||
+    text.includes("model access")
+  );
+}
+
+/**
+ * Client cancelled / closed the turn. Matches only explicit client-abort phrases
+ * produced by request handlers and adapters. Deliberately narrow: bare "client closed"
+ * would also swallow legitimate upstream failures like "upstream HTTP client
+ * closed idle connection" and turn a real 502 into a 499.
+ */
+export function isClientClosedMessage(text: string): boolean {
+  const lower = text.toLowerCase();
+  return (
+    lower.includes("client closed request") ||
+    lower.includes("client cancelled request") ||
+    lower.includes("client canceled request") ||
+    lower.includes("request canceled by client") ||
+    lower.includes("request cancelled by client")
+  );
+}
+
+export function classifyError(status: number, type: string, message: string): CodexErrorPayload {
+  const text = message.toLowerCase();
+  // Preserve explicit cancel types; unify message-inferred client closes onto
+  // client_closed_request for /api/logs.
+  if (type === "client_cancelled") {
+    return { message, type: "client_cancelled", code: "client_cancelled" };
+  }
+  if (
+    status === 499 ||
+    type === "client_closed_request" ||
+    isClientClosedMessage(text)
+  ) {
+    return { message, type: "invalid_request_error", code: "client_closed_request" };
+  }
+  if (
+    text.includes("context_length_exceeded") ||
+    text.includes("context window") ||
+    text.includes("context length") ||
+    text.includes("maximum context") ||
+    text.includes("too many tokens")
+  ) {
+    return { message, type: "invalid_request_error", code: "context_length_exceeded" };
+  }
+  if (
+    text.includes("insufficient_quota") ||
+    text.includes("exceeded your current quota") ||
+    text.includes("quota exhausted") ||
+    text.includes("account quota exceeded") ||
+    text.includes("monthly quota exceeded") ||
+    text.includes("daily quota exceeded")
+  ) {
+    return { message, type: "insufficient_quota", code: "insufficient_quota" };
+  }
+  if (
+    status === 429 ||
+    text.includes("rate limit") ||
+    text.includes("rate limited") ||
+    text.includes("too many requests") ||
+    text.includes("resource_exhausted") ||
+    text.includes("resource exhausted") ||
+    text.includes("throttlingexception") ||
+    text.includes("throttling")
+  ) {
+    return { message, type: "rate_limit_error", code: "rate_limit_exceeded" };
+  }
+  if (type === "origin_rejected") {
+    return { message, type: "invalid_request_error", code: "origin_rejected" };
+  }
+  // HTTP 401 and explicit auth failures are authoritative even when provider text
+  // also advertises an upgrade or subscription.
+  if (
+    status === 401 ||
+    type === "authentication_error" ||
+    isAuthenticationMessage(text)
+  ) {
+    return { message, type: "authentication_error", code: "invalid_api_key" };
+  }
+  // Subscription labels are valid only in a known permission context.
+  if (
+    (status === 403 || type === "permission_error") &&
+    isSubscriptionGateMessage(text)
+  ) {
+    return { message, type: "permission_error", code: "subscription_required" };
+  }
+  if (
+    status === 403 ||
+    type === "permission_error" ||
+    isPermissionMessage(text)
+  ) {
+    return { message, type: "permission_error", code: "permission_denied" };
+  }
+  if (
+    status === 503 ||
+    text.includes("overloaded") ||
+    text.includes("server is busy") ||
+    text.includes("temporarily unavailable")
+  ) {
+    // Codex recognizes "server_is_overloaded" and applies retry-after backoff
+    // (responses.rs is_server_overloaded_error); generic "upstream_server_error" is not recognized.
+    return { message, type: "server_error", code: "server_is_overloaded" };
+  }
+  if (
+    text.includes("validationexception") ||
+    text.includes("invalid request") ||
+    text.includes("model unavailable") ||
+    text.includes("model not found") ||
+    text.includes("unsupported model")
+  ) {
+    return { message, type: "invalid_request_error", code: "invalid_request_error" };
+  }
+  if (status >= 500) {
+    return { message, type: "server_error", code: "upstream_server_error" };
+  }
+  if (status === 400 || type === "invalid_request_error") {
+    return { message, type: "invalid_request_error", code: "invalid_request_error" };
+  }
+  return { message, type, code: type || null };
+}
+
+/** Best-effort parse of a retry delay embedded in an upstream error message. */
+export function parseRetryAfterFromMessage(message: string): number | undefined {
+  const patterns = [
+    /try again in (\d+(?:\.\d+)?)\s*s(?:ec(?:ond)?s?)?/i,
+    /retry after (\d+(?:\.\d+)?)\s*s(?:ec(?:ond)?s?)?/i,
+    /retry[- ]after[:\s]+(\d+)/i,
+  ];
+  for (const pattern of patterns) {
+    const match = message.match(pattern);
+    if (!match?.[1]) continue;
+    const seconds = Number.parseFloat(match[1]);
+    if (Number.isFinite(seconds) && seconds > 0) return Math.ceil(seconds);
+  }
+  return undefined;
+}
+
+/** Infer HTTP status from adapter terminal error text (provider-agnostic keyword matching). */
+export function inferHttpStatusFromAdapterMessage(message: string): number {
+  const lower = message.toLowerCase();
+  // Client aborts must not look like upstream 502s in /api/logs.
+  if (isClientClosedMessage(lower)) return 499;
+  if (
+    lower.includes("resource_exhausted") ||
+    lower.includes("resource exhausted") ||
+    lower.includes("rate limit") ||
+    lower.includes("too many requests") ||
+    lower.includes("throttling")
+  ) return 429;
+  // Strong authentication signals win when a message contains mixed auth and
+  // subscription/permission wording.
+  if (isAuthenticationMessage(lower)) return 401;
+  if (isSubscriptionGateMessage(lower) || isPermissionMessage(lower)) return 403;
+  if (
+    lower.includes("unavailable") ||
+    lower.includes("overloaded") ||
+    lower.includes("temporarily") ||
+    lower.includes("server is busy")
+  ) return 503;
+  if (
+    lower.includes("invalid") ||
+    lower.includes("not found") ||
+    lower.includes("unsupported") ||
+    lower.includes("malformed") ||
+    lower.includes("unimplemented")
+  ) return 400;
+  if (
+    lower.includes("timed out") ||
+    lower.includes("timeout") ||
+    lower.includes("etimedout") ||
+    lower.includes("deadline")
+  ) return 504;
+  return 502;
+}
+
+/** Map an adapter terminal error message to HTTP status + classified Codex error payload. */
+export function adapterFailureFromMessage(message: string): { httpStatus: number; error: CodexErrorPayload } {
+  const httpStatus = inferHttpStatusFromAdapterMessage(message);
+  let finalMessage = message;
+  const retryAfterSeconds = parseRetryAfterFromMessage(message);
+  if (retryAfterSeconds && !/please try again in /i.test(message)) {
+    finalMessage = `${message} Please try again in ${retryAfterSeconds}s.`;
+  }
+  const errorType = httpStatus === 499
+    ? "client_closed_request"
+    : httpStatus === 429
+      ? "rate_limit_error"
+      : httpStatus === 401
+        ? "authentication_error"
+        : httpStatus === 403
+          ? "permission_error"
+          : httpStatus === 503 || httpStatus === 504
+            ? "server_error"
+            : httpStatus === 400
+              ? "invalid_request_error"
+              : "upstream_error";
+  return {
+    httpStatus,
+    error: classifyError(httpStatus, errorType, finalMessage),
+  };
+}
+
+/** Map a terminal Responses error object to the HTTP status we record in /api/logs. */
+export function httpStatusFromTerminalError(error: {
+  type?: string;
+  code?: string | null;
+  message?: string;
+} | undefined): number {
+  if (!error) return 502;
+  if (error.code === "client_closed_request" || error.code === "client_cancelled") return 499;
+  if (error.type === "rate_limit_error" || error.code === "rate_limit_exceeded") return 429;
+  if (error.type === "authentication_error" || error.code === "invalid_api_key") return 401;
+  if (
+    error.type === "permission_error" ||
+    error.code === "permission_denied" ||
+    error.code === "subscription_required"
+  ) return 403;
+  if (error.type === "insufficient_quota" || error.code === "insufficient_quota") return 429;
+  if (error.type === "server_error" && error.code === "server_is_overloaded") return 503;
+  // Client-closed messages often arrive as invalid_request_error after classifyError; check message
+  // before treating every invalid_request_error as HTTP 400.
+  const message = error.message ?? "";
+  if (message && isClientClosedMessage(message)) return 499;
+  if (error.type === "invalid_request_error") return 400;
+  if (error.type === "proxy_error") return 500;
+  if (message) return inferHttpStatusFromAdapterMessage(message);
+  return 502;
+}

package/src/lib/token-estimate.ts

@@ -0,0 +1,42 @@
+import { get_encoding, type Tiktoken } from "tiktoken";
+
+/**
+ * Token accounting for ChatGPT Web prompts.
+ *
+ * A character ratio is not safe here: dense JSON/base64 can contain far more tokens than prose
+ * of the same length. Count with the tokenizer used by the GPT-5 generation instead.
+ */
+
+const TOKENIZER_CHUNK_CHARS = 4_096;
+let tokenizer: Tiktoken | undefined;
+
+function chatGptTokenizer(): Tiktoken {
+  tokenizer ??= get_encoding("o200k_base");
+  return tokenizer;
+}
+
+/**
+ * Count ordinary text conservatively without handing pathological multi-megabyte runs to one
+ * tokenizer call. Independent chunks can only lose cross-boundary merges, so their sum may
+ * over-count slightly but cannot under-count because of a missed boundary token.
+ */
+export function estimateTokens(text: string, modelId?: string): number {
+  void modelId;
+  if (!text) return 0;
+
+  const encoding = chatGptTokenizer();
+  let count = 0;
+  for (let start = 0; start < text.length;) {
+    let end = Math.min(start + TOKENIZER_CHUNK_CHARS, text.length);
+    if (end < text.length) {
+      const previous = text.charCodeAt(end - 1);
+      const next = text.charCodeAt(end);
+      if (previous >= 0xD800 && previous <= 0xDBFF && next >= 0xDC00 && next <= 0xDFFF) {
+        end -= 1;
+      }
+    }
+    count += encoding.encode_ordinary(text.slice(start, end)).length;
+    start = end;
+  }
+  return count;
+}

package/src/login-helper.cjs

@@ -0,0 +1,140 @@
+const { existsSync, mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } = require("node:fs");
+const { tmpdir } = require("node:os");
+const { dirname, join } = require("node:path");
+const { chromium } = require("playwright-core");
+
+const CHATGPT_TEMPORARY_CHAT_URL = "https://chatgpt.com/?temporary-chat=true";
+const LOGIN_STORAGE_ROOT_DOMAINS = ["chatgpt.com", "openai.com"];
+
+function allowedLoginStorageHost(rawHostname) {
+  const hostname = rawHostname.toLowerCase();
+  if (!/^[a-z0-9.-]+$/.test(hostname) || hostname.startsWith(".") || hostname.endsWith(".") || hostname.includes("..")) return false;
+  return LOGIN_STORAGE_ROOT_DOMAINS.some(root => hostname === root || hostname.endsWith(`.${root}`));
+}
+
+function sanitizeBrowserLoginStorageState(storageState) {
+  return {
+    cookies: (storageState.cookies || [])
+      .filter(cookie => !Object.prototype.hasOwnProperty.call(cookie, "partitionKey")
+        && allowedLoginStorageHost((cookie.domain || "").replace(/^\.+/, "")))
+      .map(cookie => ({ ...cookie })),
+    origins: (storageState.origins || [])
+      .filter(origin => origin.origin === "https://chatgpt.com")
+      .map(origin => ({
+        origin: origin.origin,
+        localStorage: (origin.localStorage || []).map(item => ({ ...item })),
+      })),
+  };
+}
+
+async function isUserAuthenticated(context, page) {
+  try {
+    const cookies = await context.cookies();
+    const hasAuthCookie = cookies.some(c =>
+      c.name.includes("session-token") ||
+      c.name.includes("__Secure-") ||
+      (c.domain.includes("chatgpt.com") && c.name.includes("token"))
+    );
+
+    const hasLoginButton = await page.locator(
+      'button:has-text("Log in"), a:has-text("Log in"), [data-testid="login-button"], button:has-text("Sign in")'
+    ).first().isVisible().catch(() => false);
+
+    const hasProfile = await page.locator(
+      '[data-testid="profile-button"], [data-testid="accounts-profile-button"], [data-testid="user-menu"], button[aria-label*="Account"], button[aria-label*="profile" i]'
+    ).first().isVisible().catch(() => false);
+
+    const hasComposer = await page.locator(
+      '[data-testid="prompt-textarea"], #prompt-textarea, [contenteditable="true"][data-lexical-editor="true"]'
+    ).first().isVisible().catch(() => false);
+
+    if ((hasAuthCookie || hasProfile) && !hasLoginButton && hasComposer) {
+      return true;
+    }
+  } catch {}
+  return false;
+}
+
+async function runLogin(config, options = {}) {
+  if (!existsSync(config.chromeExecutablePath)) {
+    throw new Error(`Google Chrome was not found at ${config.chromeExecutablePath}`);
+  }
+  const profileDir = mkdtempSync(join(tmpdir(), "dsh-login-profile-"));
+
+  const context = await chromium.launchPersistentContext(profileDir, {
+    executablePath: config.chromeExecutablePath,
+    headless: false,
+    ignoreDefaultArgs: ["--enable-automation", "--password-store=basic", "--use-mock-keychain"],
+    args: ["--disable-blink-features=AutomationControlled", "--no-first-run", "--no-default-browser-check"],
+  });
+
+  try {
+    const page = context.pages()[0] || await context.newPage();
+    try {
+      await page.goto(CHATGPT_TEMPORARY_CHAT_URL, { waitUntil: "domcontentloaded", timeout: 60000 });
+    } catch {
+      // In case navigation redirects immediately (e.g. to login)
+    }
+
+    const deadline = Date.now() + (options.timeoutMs || 300000);
+    let authenticatedPage;
+
+    while (Date.now() < deadline) {
+      for (const p of context.pages()) {
+        if (await isUserAuthenticated(context, p)) {
+          authenticatedPage = p;
+          break;
+        }
+      }
+      if (authenticatedPage) break;
+      await new Promise(r => setTimeout(r, 1000));
+    }
+
+    if (!authenticatedPage) {
+      throw new Error("ChatGPT login timed out after 5 minutes");
+    }
+
+    const rawState = await context.storageState();
+    const sanitized = sanitizeBrowserLoginStorageState(rawState);
+
+    const marker = {
+      version: 1,
+      authenticated: true,
+      verifiedAt: new Date().toISOString(),
+      solAvailable: false,
+      proAvailable: false,
+    };
+
+    const markerPath = `${config.storageStatePath}.verified.json`;
+    mkdirSync(dirname(config.storageStatePath), { recursive: true });
+    writeFileSync(config.storageStatePath, `${JSON.stringify(sanitized, null, 2)}\n`, "utf8");
+    writeFileSync(markerPath, `${JSON.stringify(marker, null, 2)}\n`, "utf8");
+
+    return {
+      storageStatePath: config.storageStatePath,
+      accountSurfaceUrl: authenticatedPage.url(),
+      solAvailable: false,
+      proAvailable: false,
+    };
+  } finally {
+    await context.close().catch(() => {});
+    try {
+      rmSync(profileDir, { recursive: true, force: true });
+    } catch {}
+  }
+}
+
+async function main() {
+  const payloadRaw = process.argv[2];
+  if (!payloadRaw) {
+    throw new Error("Missing config payload");
+  }
+  const payload = JSON.parse(payloadRaw);
+  const result = await runLogin(payload.config, payload.options);
+  process.stdout.write(`__RESULT__:${JSON.stringify(result)}\n`);
+}
+
+main().catch(err => {
+  process.stderr.write(`login-helper: ${err.message}\n`);
+  process.exit(1);
+});

package/src/model-catalog.ts

@@ -0,0 +1,197 @@
+import type { AppConfig } from "./config";
+import type { CodexModelContextOverride } from "./codex-integration";
+import {
+  availableChatGptWebModelRoutes,
+  CHATGPT_WEB_MODEL_PREFIX,
+  resolveChatGptWebContextLimits,
+  type ChatGptWebModelRoute,
+} from "./chatgpt-web-models";
+
+type JsonObject = Record<string, unknown>;
+
+function object(value: unknown, label: string): JsonObject {
+  if (!value || typeof value !== "object" || Array.isArray(value)) {
+    throw new Error(`${label} must be a JSON object`);
+  }
+  return value as JsonObject;
+}
+
+function slug(value: unknown): string | undefined {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return undefined;
+  const candidate = (value as JsonObject).slug;
+  return typeof candidate === "string" ? candidate : undefined;
+}
+
+function reasoningLevel(template: JsonObject, effort: string, description: string): JsonObject {
+  const levels = Array.isArray(template.supported_reasoning_levels)
+    ? template.supported_reasoning_levels.filter(level => level && typeof level === "object" && !Array.isArray(level)) as JsonObject[]
+    : [];
+  const source = levels.find(level => level.effort === effort);
+  return { ...(source ? structuredClone(source) : {}), effort, description };
+}
+
+function modelPriority(template: JsonObject): number | undefined {
+  const value = template.priority;
+  if (value === undefined) return undefined;
+  if (typeof value !== "number" || !Number.isSafeInteger(value)) {
+    throw new Error("Native Codex model template priority must be an integer");
+  }
+  return value;
+}
+
+function routedModelPriority(
+  template: JsonObject,
+  route: ChatGptWebModelRoute,
+  config: AppConfig,
+): number | undefined {
+  const priority = modelPriority(template);
+  if (priority === undefined
+    || config.subagentProtocol !== "compatibility-v1"
+    || route.slug !== "chatgpt-web/light") return priority;
+  if (priority === Number.MAX_SAFE_INTEGER) {
+    throw new Error("Native Codex model template priority cannot reserve the Compatibility V1 roster");
+  }
+  // Codex V1 exposes at most five model overrides. Keep the native Sol row plus the four useful
+  // delegated Web efforts (Medium, High, Extra High, Pro); Instant remains a selectable root model
+  // but does not displace Pro from spawn_agent's bounded registry.
+  return priority + 1;
+}
+
+function nativeTemplateCandidate(value: unknown, requireTools: boolean): value is JsonObject {
+  if (!value || typeof value !== "object" || Array.isArray(value)) return false;
+  const model = value as JsonObject;
+  const modelSlug = slug(model);
+  if (!modelSlug || modelSlug.startsWith(CHATGPT_WEB_MODEL_PREFIX)) return false;
+  // This route forwards ChatGPT authentication. Codex's own model manager keeps every list-visible
+  // model in ChatGPT mode even when `supported_in_api` is false; that flag gates API-key mode, not
+  // whether the backend row is a valid catalog template. The routed Web row overrides the flag to
+  // true because this local Responses endpoint implements it.
+  if (model.visibility !== "list") return false;
+  if (!Array.isArray(model.supported_reasoning_levels)) return false;
+  return !requireTools || (typeof model.tool_mode === "string" && model.tool_mode.length > 0);
+}
+
+function selectNativeTemplate(models: unknown[], config: AppConfig): JsonObject {
+  const requireTools = config.mode === "full";
+  const candidates = models.filter(model => nativeTemplateCandidate(model, requireTools)) as JsonObject[];
+  const template = candidates[0];
+  if (template) return template;
+  throw new Error(
+    requireTools
+      ? "Native Codex models response has no list-visible, tool-capable model with reasoning metadata"
+      : "Native Codex models response has no list-visible model with reasoning metadata",
+  );
+}
+
+function useCompatibilityV1SubagentSurface(model: JsonObject): void {
+  // Compatibility V1 is an explicit whole-task protocol mode. Preserve an explicit disabled
+  // capability instead of advertising support that the native model denied.
+  if (model.multi_agent_version !== "disabled") model.multi_agent_version = "v1";
+}
+
+function routedSubagentVersion(template: JsonObject, config: AppConfig): string | undefined {
+  if (config.subagentProtocol === "compatibility-v1") return "v1";
+  return typeof template.multi_agent_version === "string" ? template.multi_agent_version : undefined;
+}
+
+export function buildChatGptWebModel(
+  templateValue: unknown,
+  route: ChatGptWebModelRoute,
+  config: AppConfig,
+): JsonObject {
+  const template = object(templateValue, "native Codex model template");
+  const templateSlug = slug(template);
+  if (!templateSlug || templateSlug.startsWith(CHATGPT_WEB_MODEL_PREFIX)) {
+    throw new Error("ChatGPT Web model template must be a native Codex model");
+  }
+  const limits = resolveChatGptWebContextLimits(route.backendModel, route.adapterEffort, config);
+  const multiAgentVersion = routedSubagentVersion(template, config);
+  const priority = routedModelPriority(template, route, config);
+  const model: JsonObject = {
+    ...structuredClone(template),
+    slug: route.slug,
+    display_name: route.displayName,
+    description: route.description,
+    input_modalities: route.interactionMode === "manual" ? ["text"] : ["text", "image"],
+    visibility: "list",
+    // These slugs are implemented by this local Responses-compatible bridge. Marking them false
+    // makes Codex drop them from spawn_agent whenever openai_base_url points at the bridge.
+    supported_in_api: true,
+    // Follow the official template's ordering without outranking it. Codex advertises at most five
+    // spawn-agent overrides; forcing every routed row to priority 0 displaced gpt-5.6-sol from that
+    // registry and made an explicit native child model fail validation.
+    ...(priority === undefined ? {} : { priority }),
+    // In native mode the routed row follows the official template's protocol surface. Web-origin
+    // V2 collaboration calls carry the protocol's explicit plaintext marker; Compatibility V1
+    // instead pins the entire catalog and Codex feature override to V1.
+    ...(multiAgentVersion === undefined
+      ? {}
+      : { multi_agent_version: multiAgentVersion }),
+    // Code mode collapses the outer registry into an exec gateway; routed models need the regular
+    // Responses tool surface so MCP namespaces, deferred tool_search, and custom tools reach us.
+    tool_mode: null,
+    upgrade: null,
+    default_reasoning_level: route.codexEffort,
+    supported_reasoning_levels: [reasoningLevel(template, route.codexEffort, route.displayName)],
+    context_window: limits.contextWindow,
+    max_context_window: limits.contextWindow,
+    effective_context_window_percent: limits.effectiveContextWindowPercent,
+    auto_compact_token_limit: limits.autoCompactTokenLimit,
+    // ChatGPT Web has no Codex service tier. Never inherit the native template's Fast tiers.
+    additional_speed_tiers: [],
+    service_tiers: [],
+    default_service_tier: null,
+  };
+  // A native template's compaction hash describes OpenAI's native model contract, not this routed
+  // browser model. The explicit Web window above is owned by this adapter and never copied back to
+  // native models or the user's top-level model_context_window setting.
+  delete model.comp_hash;
+  delete model.availability_nux;
+  return model;
+}
+
+export function augmentNativeModelCatalog(
+  value: unknown,
+  config: AppConfig,
+  contextOverride?: CodexModelContextOverride,
+): JsonObject {
+  const catalog = object(value, "native Codex models response");
+  if (!Array.isArray(catalog.models)) {
+    throw new Error("Native Codex models response is missing a models array");
+  }
+  const nativeModels = structuredClone(
+    catalog.models.filter(model => !slug(model)?.startsWith(CHATGPT_WEB_MODEL_PREFIX)),
+  );
+  if (config.subagentProtocol === "compatibility-v1") {
+    for (const candidate of nativeModels) {
+      if (candidate && typeof candidate === "object" && !Array.isArray(candidate)) {
+        useCompatibilityV1SubagentSurface(candidate as JsonObject);
+      }
+    }
+  }
+  const template = selectNativeTemplate(nativeModels, config);
+  if (contextOverride) {
+    // model_context_window is a single top-level Codex setting, not a per-model one. Apply its
+    // advertised maximum to every native row so switching native models cannot silently clamp the
+    // effective override. Codex itself applies context_window and auto-compaction configuration.
+    for (const candidate of nativeModels) {
+      const modelSlug = slug(candidate);
+      if (!modelSlug) continue;
+      const model = object(candidate, `native ${modelSlug} model`);
+      const current = model.max_context_window;
+      if (current !== undefined && current !== null
+        && (typeof current !== "number" || !Number.isSafeInteger(current) || current <= 0)) {
+        throw new Error(`Native ${modelSlug} max_context_window must be a positive integer`);
+      }
+      if (current === undefined || current === null || current < contextOverride.contextWindow) {
+        model.max_context_window = contextOverride.contextWindow;
+      }
+    }
+  }
+  const webModels = availableChatGptWebModelRoutes(config)
+    .map(route => buildChatGptWebModel(template, route, config));
+  return {
+    ...structuredClone(catalog),
+    models: [...nativeModels, ...webModels],
+  };
+}